a5a2560bd51ad2fa3d4bfbe8a1b0c47dbe02a574db1398533e510e4087754924

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe
Size 243KB
Sample260702-wpxvsabv5t
SHA256 a5a2560bd51ad2fa3d4bfbe8a1b0c47dbe02a574db1398533e510e4087754924
MD5 2ab388f4edd38236ea086fd7631e49a5
SHA1 8d0634d629428fa7c0e9af518ca5b882f37ab151
SHA512 9aab1be1f06b4abb8125368e5d6f01ccad2be8b9015e7ab14b62dbe43d2eefec5f812a102620d6a91a46eb16182c649341895ac637f1173090000bd08dc7cc2c
SSDEEP 3072:ZVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:rXP7LQMa3lLNngoqRttA7Y
TLSH
T197345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4244	CP.exe
3332	mkhczupmhf.exe
4464	CP.exe
5964	CP.exe
2240	i_mkhczupmhf.exe
5076	zurmkecwuo.sys
1364	CP.exe
5696	rpjhbztrmj.exe
2824	CP.exe
5348	CP.exe
3492	i_rpjhbztrmj.exe
572	mgezwuomge.sys
2764	CP.exe
4688	ztrojgbzto.exe
5772	CP.exe
1500	CP.exe
6104	i_ztrojgbzto.exe
3396	bvtolgeywq.sys
4872	CP.exe
5816	bwtomgdbyw.exe
1320	CP.exe
5252	CP.exe
4300	i_bwtomgdbyw.exe
1916	gdbvtqolfd.sys
4820	CP.exe
3816	gdbvtqlidb.exe
2752	CP.exe
2072	CP.exe
4088	i_gdbvtqlidb.exe
2432	idbvtnlfdy.sys
4456	CP.exe
400	fdxvqnifdy.exe
3640	CP.exe
3532	CP.exe
4488	i_fdxvqnifdy.exe
5496	vsnlfdxvqn.sys
6036	CP.exe
3580	fausnkfcxv.exe
1612	CP.exe
5812	CP.exe
3116	i_fausnkfcxv.exe
984	qkiczxspki.sys
5476	CP.exe
2860	nkicausmkf.exe
2900	CP.exe
5244	CP.exe
2084	i_nkicausmkf.exe
1712	usmkecxupn.sys
3956	CP.exe
1096	smkecxupmh.exe
3364	CP.exe
3196	CP.exe
3656	i_smkecxupmh.exe
4092	hecwuomhez.sys
6072	CP.exe
3888	ezwrpjhbzx.exe
4488	CP.exe
3372	CP.exe
1192	i_ezwrpjhbzx.exe
2392	uomjhbzurm.sys
4496	CP.exe
1520	gbztrljdbw.exe
5024	CP.exe
3008	CP.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4380_1525782781\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4380_459272367\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4380_459272367\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgdbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fausnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurpjztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnifdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fausnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgdbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrojgbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrojgbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurpjztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnifdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqljdb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5624	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4088	ipconfig.exe
3304	ipconfig.exe
4128	ipconfig.exe
6128	ipconfig.exe
5304	ipconfig.exe
4908	ipconfig.exe
4704	ipconfig.exe
5656	ipconfig.exe
4528	ipconfig.exe
1476	ipconfig.exe
3852	ipconfig.exe
3880	ipconfig.exe
3848	ipconfig.exe
2648	ipconfig.exe
3412	ipconfig.exe
4196	ipconfig.exe
3532	ipconfig.exe
5752	ipconfig.exe
764	ipconfig.exe
6040	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274891919247663"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{E6008F2B-B02E-4C47-A9A0-860C32017331}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5888	msedge.exe
5888	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	i_mkhczupmhf.exe
Token: SeDebugPrivilege	3492	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	6104	i_ztrojgbzto.exe
Token: SeDebugPrivilege	4300	i_bwtomgdbyw.exe
Token: SeDebugPrivilege	4088	i_gdbvtqlidb.exe
Token: SeDebugPrivilege	4488	i_fdxvqnifdy.exe
Token: SeDebugPrivilege	3116	i_fausnkfcxv.exe
Token: SeDebugPrivilege	2084	i_nkicausmkf.exe
Token: SeDebugPrivilege	3656	i_smkecxupmh.exe
Token: SeDebugPrivilege	1192	i_ezwrpjhbzx.exe
Token: SeDebugPrivilege	1396	i_gbztrljdbw.exe
Token: SeDebugPrivilege	2868	i_mgebztrljd.exe
Token: SeDebugPrivilege	1100	i_igaytqljdb.exe
Token: SeDebugPrivilege	2852	i_oigaysqkid.exe
Token: SeDebugPrivilege	6096	i_icavsnkfdx.exe
Token: SeDebugPrivilege	1268	i_usnkfcxvpn.exe
Token: SeDebugPrivilege	4116	i_smkfcxvpnh.exe
Token: SeDebugPrivilege	4088	i_cwupmhfzxr.exe
Token: SeDebugPrivilege	4740	i_ecwurpjztr.exe
Token: SeDebugPrivilege	3972	i_jebztrmjeb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 992	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	88
PID 992 wrote to memory of 4380	992	iexplore.exe	89
PID 4380 wrote to memory of 4284	4380	msedge.exe	90
PID 4380 wrote to memory of 5148	4380	msedge.exe	91
PID 4380 wrote to memory of 5624	4380	msedge.exe	92
PID 4380 wrote to memory of 5148	4380	msedge.exe	91
PID 4380 wrote to memory of 5148	4380	msedge.exe	91
PID 4380 wrote to memory of 5584	4380	msedge.exe	93
PID 4380 wrote to memory of 5584	4380	msedge.exe	93
PID 4380 wrote to memory of 5920	4380	msedge.exe	95
PID 4380 wrote to memory of 5920	4380	msedge.exe	95
PID 4380 wrote to memory of 5920	4380	msedge.exe	95
PID 4380 wrote to memory of 1596	4380	msedge.exe	96
PID 4380 wrote to memory of 1596	4380	msedge.exe	96
PID 4380 wrote to memory of 1596	4380	msedge.exe	96
PID 4380 wrote to memory of 5424	4380	msedge.exe	97
PID 4380 wrote to memory of 1960	4380	msedge.exe	98
PID 4380 wrote to memory of 5424	4380	msedge.exe	97
PID 4380 wrote to memory of 5424	4380	msedge.exe	97
PID 4380 wrote to memory of 1960	4380	msedge.exe	98
PID 4380 wrote to memory of 1960	4380	msedge.exe	98
PID 4380 wrote to memory of 3384	4380	msedge.exe	99
PID 4380 wrote to memory of 3384	4380	msedge.exe	99
PID 4380 wrote to memory of 2032	4380	msedge.exe	101
PID 4380 wrote to memory of 3728	4380	msedge.exe	102
PID 4380 wrote to memory of 2032	4380	msedge.exe	101
PID 4380 wrote to memory of 3728	4380	msedge.exe	102
PID 4728 wrote to memory of 4244	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	103
PID 4380 wrote to memory of 4388	4380	msedge.exe	106
PID 3332 wrote to memory of 4464	3332	mkhczupmhf.exe	108
PID 4380 wrote to memory of 2516	4380	msedge.exe	113
PID 4380 wrote to memory of 2516	4380	msedge.exe	113
PID 4380 wrote to memory of 5504	4380	msedge.exe	114
PID 4380 wrote to memory of 5504	4380	msedge.exe	114
PID 4728 wrote to memory of 5964	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	115
PID 4728 wrote to memory of 1364	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	119
PID 5696 wrote to memory of 2824	5696	rpjhbztrmj.exe	121
PID 4728 wrote to memory of 5348	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	124
PID 4728 wrote to memory of 2764	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	128
PID 4688 wrote to memory of 5772	4688	ztrojgbzto.exe	130
PID 4728 wrote to memory of 1500	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	133
PID 4728 wrote to memory of 4872	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	137
PID 5816 wrote to memory of 1320	5816	bwtomgdbyw.exe	139
PID 4728 wrote to memory of 5252	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	142
PID 4380 wrote to memory of 5244	4380	msedge.exe	145
PID 4380 wrote to memory of 5504	4380	msedge.exe	146
PID 4380 wrote to memory of 1532	4380	msedge.exe	147
PID 4728 wrote to memory of 4820	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	150
PID 3816 wrote to memory of 2752	3816	gdbvtqlidb.exe	152
PID 4728 wrote to memory of 2072	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	155
PID 4728 wrote to memory of 4456	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	159
PID 400 wrote to memory of 3640	400	fdxvqnifdy.exe	161
PID 4728 wrote to memory of 3532	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	164
PID 4728 wrote to memory of 6036	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	168
PID 3580 wrote to memory of 1612	3580	fausnkfcxv.exe	170
PID 4728 wrote to memory of 5812	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	173
PID 4728 wrote to memory of 5476	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	177
PID 2860 wrote to memory of 2900	2860	nkicausmkf.exe	179
PID 4728 wrote to memory of 5244	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	182
PID 4380 wrote to memory of 4324	4380	msedge.exe	184
PID 4380 wrote to memory of 4324	4380	msedge.exe	184
PID 4728 wrote to memory of 3956	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	190
PID 1096 wrote to memory of 3364	1096	smkecxupmh.exe	192
PID 4728 wrote to memory of 3196	4728	2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_2ab388f4edd38236ea086fd7631e49a5_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x308,0x7fff8f71c188,0x7fff8f71c194,0x7fff8f71c1a0
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,16569112190915371512,4850560475578330247,262144 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,1900440936280281519,2517064756836175874,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
      4⤵
      System Time Discovery
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,16739549981604017602,1890518374546206648,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,7320777368692260864,11864699013189778267,2097152 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,4096644414330869035,944312449647294976,2097152 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,11615999489537825505,5510673454380196516,2097152 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,261555355437294247,6643100639827354947,2097152 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:9
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,8665500531908191667,1098866805905577329,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,7855462128129937877,16983227376855989894,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,4009080761999683710,14533451363733235240,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,18003803850171456441,7706489337605187256,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,18003803850171456441,7706489337605187256,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14141881376093409863,9734968949389189044,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,9821070097201294981,16446735871698019721,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9878663722998932529,13859633022296091314,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,1039548810410843042,10535531338048945108,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,12866507873459374518,56544959998242188,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,4526582101455550687,18029610996086913107,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,17162958508502574047,17577124710887420987,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,13034951562154291739,3136702571068827479,262144 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,7104475373880712703,1391613395249626453,524288 --field-trial-handle=2368,i,9181475325080102503,12405653948471163247,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczupmhf.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4244
- - C:\Temp\mkhczupmhf.exe
    C:\Temp\mkhczupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczupmhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5964
- - C:\Temp\i_mkhczupmhf.exe
    C:\Temp\i_mkhczupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1364
- - C:\Temp\rpjhbztrmj.exe
    C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5348
- - C:\Temp\i_rpjhbztrmj.exe
    C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrojgbzto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Temp\ztrojgbzto.exe
    C:\Temp\ztrojgbzto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrojgbzto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1500
- - C:\Temp\i_ztrojgbzto.exe
    C:\Temp\i_ztrojgbzto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgdbyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4872
- - C:\Temp\bwtomgdbyw.exe
    C:\Temp\bwtomgdbyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgdbyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5252
- - C:\Temp\i_bwtomgdbyw.exe
    C:\Temp\i_bwtomgdbyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbvtqlidb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4820
- - C:\Temp\gdbvtqlidb.exe
    C:\Temp\gdbvtqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbvtqlidb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2072
- - C:\Temp\i_gdbvtqlidb.exe
    C:\Temp\i_gdbvtqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnifdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4456
- - C:\Temp\fdxvqnifdy.exe
    C:\Temp\fdxvqnifdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnifdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3532
- - C:\Temp\i_fdxvqnifdy.exe
    C:\Temp\i_fdxvqnifdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fausnkfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6036
- - C:\Temp\fausnkfcxv.exe
    C:\Temp\fausnkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fausnkfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\i_fausnkfcxv.exe
    C:\Temp\i_fausnkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkicausmkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5476
- - C:\Temp\nkicausmkf.exe
    C:\Temp\nkicausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkicausmkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5244
- - C:\Temp\i_nkicausmkf.exe
    C:\Temp\i_nkicausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3956
- - C:\Temp\smkecxupmh.exe
    C:\Temp\smkecxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\i_smkecxupmh.exe
    C:\Temp\i_smkecxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6072
- - C:\Temp\ezwrpjhbzx.exe
    C:\Temp\ezwrpjhbzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Temp\i_ezwrpjhbzx.exe
    C:\Temp\i_ezwrpjhbzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgebztrljd.exe ups_run
  2⤵
  PID:6108
- - C:\Temp\mgebztrljd.exe
    C:\Temp\mgebztrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgebztrljd.exe ups_ins
  2⤵
  PID:2648
- - C:\Temp\i_mgebztrljd.exe
    C:\Temp\i_mgebztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqljdb.exe ups_run
  2⤵
  PID:1244
- - C:\Temp\igaytqljdb.exe
    C:\Temp\igaytqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqljdb.exe ups_ins
  2⤵
  PID:2164
- - C:\Temp\i_igaytqljdb.exe
    C:\Temp\i_igaytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaysqkid.exe ups_run
  2⤵
  PID:2304
- - C:\Temp\oigaysqkid.exe
    C:\Temp\oigaysqkid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaysqkid.exe ups_ins
  2⤵
  PID:2516
- - C:\Temp\i_oigaysqkid.exe
    C:\Temp\i_oigaysqkid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnkfdx.exe ups_run
  2⤵
  PID:5416
- - C:\Temp\icavsnkfdx.exe
    C:\Temp\icavsnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnkfdx.exe ups_ins
  2⤵
  PID:5432
- - C:\Temp\i_icavsnkfdx.exe
    C:\Temp\i_icavsnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfcxvpn.exe ups_run
  2⤵
  PID:2548
- - C:\Temp\usnkfcxvpn.exe
    C:\Temp\usnkfcxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfcxvpn.exe ups_ins
  2⤵
  PID:484
- - C:\Temp\i_usnkfcxvpn.exe
    C:\Temp\i_usnkfcxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run
  2⤵
  PID:3208
- - C:\Temp\smkfcxvpnh.exe
    C:\Temp\smkfcxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins
  2⤵
  PID:4508
- - C:\Temp\i_smkfcxvpnh.exe
    C:\Temp\i_smkfcxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhfzxr.exe ups_run
  2⤵
  PID:6044
- - C:\Temp\cwupmhfzxr.exe
    C:\Temp\cwupmhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhfzxr.exe ups_ins
  2⤵
  PID:5492
- - C:\Temp\i_cwupmhfzxr.exe
    C:\Temp\i_cwupmhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwurpjztr.exe ups_run
  2⤵
  PID:1972
- - C:\Temp\ecwurpjztr.exe
    C:\Temp\ecwurpjztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwurpjztr.exe ups_ins
  2⤵
  PID:6020
- - C:\Temp\i_ecwurpjztr.exe
    C:\Temp\i_ecwurpjztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebztrmjeb.exe ups_run
  2⤵
  PID:5412
- - C:\Temp\jebztrmjeb.exe
    C:\Temp\jebztrmjeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebztrmjeb.exe ups_ins
  2⤵
  PID:5280
- - C:\Temp\i_jebztrmjeb.exe
    C:\Temp\i_jebztrmjeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4688

C:\Temp\zurmkecwuo.sys
C:\Temp\zurmkecwuo.sys
1⤵
- Executes dropped EXE
PID:5076

C:\Temp\mgezwuomge.sys
C:\Temp\mgezwuomge.sys
1⤵
- Executes dropped EXE
PID:572

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Temp\gdbvtqolfd.sys
C:\Temp\gdbvtqolfd.sys
1⤵
- Executes dropped EXE
PID:1916

C:\Temp\idbvtnlfdy.sys
C:\Temp\idbvtnlfdy.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Temp\vsnlfdxvqn.sys
C:\Temp\vsnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:5496

C:\Temp\qkiczxspki.sys
C:\Temp\qkiczxspki.sys
1⤵
- Executes dropped EXE
PID:984

C:\Temp\usmkecxupn.sys
C:\Temp\usmkecxupn.sys
1⤵
- Executes dropped EXE
PID:1712

C:\Temp\hecwuomhez.sys
C:\Temp\hecwuomhez.sys
1⤵
- Executes dropped EXE
PID:4092

C:\Temp\uomjhbzurm.sys
C:\Temp\uomjhbzurm.sys
1⤵
- Executes dropped EXE
PID:2392

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
PID:5592

C:\Temp\igaywtoljd.sys
C:\Temp\igaywtoljd.sys
1⤵
PID:576

C:\Temp\qoigaykida.sys
C:\Temp\qoigaykida.sys
1⤵
PID:3396

C:\Temp\snkigaysqk.sys
C:\Temp\snkigaysqk.sys
1⤵
PID:5592

C:\Temp\xvpnifaxsq.sys
C:\Temp\xvpnifaxsq.sys
1⤵
PID:3820

C:\Temp\xrpkhfcxus.sys
C:\Temp\xrpkhfcxus.sys
1⤵
PID:4436

C:\Temp\khcaukecxu.sys
C:\Temp\khcaukecxu.sys
1⤵
PID:5592

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
PID:5388

C:\Temp\hbztromjeb.sys
C:\Temp\hbztromjeb.sys
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywq.sys

Path C:\Temp\bvtolgeywq.sys
Size 141KB
SHA256 b86547e2f446098a37b4e3185290ec772ff24ff4212f837e96761ba45cf1530e
MD5 319ac813200c604d4de3bd9ecc19348e
SHA1 1128255a72a80bdae617fcbd67a0d1744747264b
SHA512 53506db6f0e801f9c91c24a32551782e4bad0387db427b529d78dea2a98452df5b7e037ec540fa533f144b59a720590c86f2a939dc551f2ce73e21f29e289862
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T159E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtomgdbyw.exe

Path C:\Temp\bwtomgdbyw.exe
Size 243KB
SHA256 9f5eae25cd3b333dfd418dc996795c93cd5feeda43c73068b48f4e06b682c801
MD5 c8a685ad6e7d9423209330917c1af94b
SHA1 943b1eb58b48bc9f5b70e6497bba3e29d6a55888
SHA512 b022dd559b40b4b3ad844f44fec5519d349dfb89105402afd1ad46c17f09acad8ae87448600541b40f7bb890cfb8538356e7669dfa57d7ace179818e36207454
SSDEEP 3072:gVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:MXP7LQMa3lLNngoqRttA7d
TLSH
T1C8345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnifdy.exe

Path C:\Temp\fdxvqnifdy.exe
Size 243KB
SHA256 08cfd5dfc401aa204c7e36af1ea9a2a8c057626109001ba24820519e33af7661
MD5 07e63ba8035268eda9aab37902e6e2da
SHA1 242728f913d14d197c404e2a9e120f363f1c61c8
SHA512 51d796f30c919dea127751dc729842d09a32260e705f4c4e81cc639f5879d458373e0f7baa31ddd425fb9964b721ec39261a6b62e685bbf6fd47489abce90398
SSDEEP 3072:CVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:CXP7LQMa3lLNngoqRttA73
TLSH
T17A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvtqlidb.exe

Path C:\Temp\gdbvtqlidb.exe
Size 243KB
SHA256 489b147a89cdd2205fffff258403eaca6a496901eb603b71ca1c84fe3d15f732
MD5 1bb06fdc610b2e4d6219bf10ab0cf5c9
SHA1 fedc7672366cf1b779b603ae2f8af6dbf9c710d5
SHA512 ec3388c93e0461c8efed6d3a63121f0e8fbcbd2a18de0ee0b2823f67bebddf204f230a55e2af56d7a4fe17629b642c1580cb4656b6004d01b32d8936f4d47d85
SSDEEP 3072:/VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:NXP7LQMa3lLNngoqRttA7y
TLSH
T1C4345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvtqolfd.sys

Path C:\Temp\gdbvtqolfd.sys
Size 141KB
SHA256 79f076f26822dbd31f43e80e992d8b5edaf708c27a56237e6b49958accec874f
MD5 7a9a24788875b94beaaf4f527f12f4fc
SHA1 343eb3ace2ea3521ada13dfef5615ae018cb1cbc
SHA512 870026a4a926d1b74b9c135458af176f768dbf03c6d03b9e93ef45ad7acb054dbebcd4af32044829c1fb0ece7121a79f5aa5857fcf9977523de66fecd601bc93
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D3E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtomgdbyw.exe

Path C:\Temp\i_bwtomgdbyw.exe
Size 243KB
SHA256 935d30867043e8d6a64e2b8506a84e5717004d009f4a6b5dca443b37e34478d1
MD5 a37f27fd7cd9c45b1e848cd6e7f7fdce
SHA1 fc202129fc78d00191ecfcade2c177bec6c9bfaa
SHA512 b54364fb4077ac8c1624aa9ced0fd317c021ec0ecd058fcd1859dcfd02d62b1f80893b359a7a260592ce8101348d9e8e60e75025ff03ba9cf8194137f7eb84f3
SSDEEP 3072:rVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:5XP7LQMa3lLNngoqRttA7q
TLSH
T166345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvqnifdy.exe

Path C:\Temp\i_fdxvqnifdy.exe
Size 243KB
SHA256 a1f7eebb931fdbdad29a8cb1a46318f4ce6d568047a95660acb46abaf0529878
MD5 2101f7af06357234ece1097f8fdcdd0c
SHA1 2d834711fbf27fb7499a3ba1e1f5103cb0a8e423
SHA512 5c19abe72c439f6b149f2de2317f13e6ca0bb3854f19a7fe8cfa6c14abe404b61781f8e0183223f03efed792499ab2842f80e87dfb8bb64a0dc0296b6897a9c4
SSDEEP 3072:AVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:sXP7LQMa3lLNngoqRttA7R
TLSH
T1C0345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdbvtqlidb.exe

Path C:\Temp\i_gdbvtqlidb.exe
Size 243KB
SHA256 10ce3e56fb3c2500e4e4ad84d8f25d66280687fc92ba06532f8af2f44211925f
MD5 b79296c2751a28fb4de630eb5670d333
SHA1 48df969f0ef01369abe3229f9a0d168a04ef22b8
SHA512 bef9f6caf40489c085d08273b4ec1eda66d7d045b9d0eeb43aa730411450564339b00b03ccae4048abeeea07e0d8fab33e101b1448be3c04e58c3e04a510e852
SSDEEP 3072:3VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:lXP7LQMa3lLNngoqRttA76
TLSH
T13E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhczupmhf.exe

Path C:\Temp\i_mkhczupmhf.exe
Size 243KB
SHA256 dcdbfc0081d95dae19952bfa94adc80d81c2832ade384f760bb281ebbc923263
MD5 9882697705141172bc7a89f3cc151c6b
SHA1 a0d03315c0862f2cb4a7a4029c9c10cd4e3016a1
SHA512 c7adc8793bef468e0c01ffd64991119a24462c191eee0133f522e8bebc73e265d4158564a841aa3caf1abd0502d9d4491196908694d275242f92770d584134a7
SSDEEP 3072:AVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:sXP7LQMa3lLNngoqRttA7J
TLSH
T1EE345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbztrmj.exe

Path C:\Temp\i_rpjhbztrmj.exe
Size 243KB
SHA256 519a744ff540496479397ed76be35a665a1a519392f3bd9c936d8ca9717373c1
MD5 9eb9ad7d27e4975eb8c3cd57d677f5c7
SHA1 d57c352c5af5efabb79db8a3cdcbf12e4591dda1
SHA512 6fdce2fe0d3cc2a690576b0e564416c206867377cc9484f8c0e8515fa7619b16504e9e125ffa7ed0a2a609136ddd32a12c69e9bf6a342777a79a708b8d7ed520
SSDEEP 3072:EVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:AXP7LQMa3lLNngoqRttA7F
TLSH
T198345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrojgbzto.exe

Path C:\Temp\i_ztrojgbzto.exe
Size 243KB
SHA256 43c4f93fb290e49ff9b8b4b785c39671abd832e7c41022522572ad75fbdf50ff
MD5 42e2004468d8442972aa7eec896f19c1
SHA1 0b54faee1c38e27f569fcba0e9cd01c1300f8c6d
SHA512 8ca52d645c4349ab36425bc71a7186a5995ca2ca64de378549341d2fbbc7e46bb5cb4498c6e1da96c0301aff2d8d83e618256db65681f0e8f79f22ecb0b07fff
SSDEEP 3072:DVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:RXP7LQMa3lLNngoqRttA76
TLSH
T16B345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlfdy.sys

Path C:\Temp\idbvtnlfdy.sys
Size 141KB
SHA256 69a421646fa92c5b7148f6cd82442845c473dbb792f67fbb76ac52959e8f0136
MD5 7094a37350ea91ff5c788610cb41211a
SHA1 fab3012ee42be8592fbe9c5f32c267f316f3d7ce
SHA512 5ca727853384af41f54b9267a90b3ece80a79f243eb61ca0f7387d94668a76931b62723e587edcbbb3e1fb97e739e7ff5e3dd4ecfd1cd1df1288a0d07b1dbcc5
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltg:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T138E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwuomge.sys

Path C:\Temp\mgezwuomge.sys
Size 141KB
SHA256 4408a11d65bde908cecfbcc8bc6bd8cf4b92e35f9192c502d13182a1c45e97a7
MD5 0c147d51d7aa637ba114888fb77dca53
SHA1 8f7a4bd874dca845fbae1beeacbb6fe47b4b3d31
SHA512 71f816644e5cc244df082ab53d185cd162ddde5781a7a8d1970427952f9715948f3dcae7ed3bce687d2a9f5530575efd6b19f1b52cf251a37cf5c7a266de31c1
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T143E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczupmhf.exe

Path C:\Temp\mkhczupmhf.exe
Size 243KB
SHA256 366cc7933340647e107b04fa1acbed0965c314a87b7eff44d3472bbc2774b57a
MD5 81df77fedd9dc33117bce0dde8d7aa4b
SHA1 a64d96b2988263094d4fae60072c2df1ba9fc24c
SHA512 173eb846a6bf39c820ef2b2fdb7c4278332cf0aeea0c173949cbf86047a82ccd25e5cdcb1e16cccc46830b74131d917c5edb88f42e78d9ff864002b2b0dbdeba
SSDEEP 3072:pVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:7XP7LQMa3lLNngoqRttA7U
TLSH
T143345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbztrmj.exe

Path C:\Temp\rpjhbztrmj.exe
Size 243KB
SHA256 ac1c31efe58f773db5693ce01bb7132f5ffd29e9af844bf5ff0350a530915aeb
MD5 f194f20dc668d80b0c2f6e1ba212ad07
SHA1 3f0fdd312018358bfa4fa54cba95a1a43cbad781
SHA512 10ef9d775c927ba892d40f59a03e643e8e873cee1392827653fec3ce31fa3c6539ef02f8cf7cce3ef8938b13cc47b9bec87fa159327a5035a56aba2f67707517
SSDEEP 3072:0VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:wXP7LQMa3lLNngoqRttA7Z
TLSH
T1C9345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.sys

Path C:\Temp\vsnlfdxvqn.sys
Size 141KB
SHA256 1f42b6e474fef3e16de9553da7f1096827f2cc5fd273d767ab641eae54097e6c
MD5 2303c6a2001ad71c172dae995d3e410f
SHA1 c7672b9eeba42ee3e168d58d00a672354e3070df
SHA512 7a57fb54ed592ac3a412f4c46e53b3f8a340b54a9cbc4489d2f0dfd364bc3563cf4fd688455d591ea95f9823829a7a0af2e334bff654695bd8912af95851a2cd
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T160E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrojgbzto.exe

Path C:\Temp\ztrojgbzto.exe
Size 243KB
SHA256 9fc6ed9b9e4424143958d292a7692b829ce1ff14849a0040782ce85f28538b0d
MD5 116c3ed201f99445951e3b4b85a9cc14
SHA1 7a50fd83be76af36300c913f9f1d46076a51cb8a
SHA512 58daf3250c7466eb74f28f6918deb666c12e2b31c8947ef6f1d427e7ba562b91aafd0c8ca83a7756e42de76b153125ac635b0a4d1edbdc513f40d2b9f2d6d22d
SSDEEP 3072:4VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:EXP7LQMa3lLNngoqRttA75
TLSH
T141345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuo.sys

Path C:\Temp\zurmkecwuo.sys
Size 141KB
SHA256 880c17d603be47b55a4fbaf4ea6b0615d6e5bd2b6e1acab7a26c4e1b777d8f19
MD5 e390ce134ecd809626a11b548ba211df
SHA1 d31f3b750b02c8f9a657c65b6627506691f62865
SHA512 9e8d0d6db90b9ff0409ec86459e7328b8af2001e773b890a6bf297a4f38008358369d0b1a054711da6c62e585f854878014b28d08685bb70f38c7f023a2b3c2d
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T148E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d3b673d99fb712aa3f57fc2e77c1922d233afb1cbf1c3b1cba3b8ea226e6b920
MD5 69ec447acb09cbbed20f9c470451ae51
SHA1 7f71f6634c16c149b3189ab5aad335bfb843a230
SHA512 81b34dd6dfc0718a40b40ba313a7e1c59c50efbe753ad41128a13ca40869da4eb39cabd54f7eff14941c08badb3ef857ea7dc96579e203979d73635f61f2ce5c
TLSH
T1C2613FD8E8D13B2EEBAB0CB74AD724D97732C4B207076907685A8F78945A71660610B2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596836.TMP
Size 3KB
SHA256 4caffa626b6d85488edad8ad613f6f84fd470da11a40763c0e9271a29ba5f795
MD5 0c6a846aceb3d8b93d6ff3d18cb0db0e
SHA1 49063a0065266bf67484edde1ea87037a3abff2b
SHA512 a71639f907d4df02ba2146e264a84d2fdadb7150eddb6756be77d511b5357e981a9d9219708b26eb343a25852b55e06b69915f72e15cafb38955834e9224e653
TLSH
T1C96141D8E8D13B2EEBE70CF74AD724D97732C4B207076D076C5A8F78945A71660610B2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 22bffe6e708037433df1eef11ff2da438a3a4058ca139468ee2096618229a3d0
MD5 3e012935c612b56465956bfd33bddb77
SHA1 adc8b52be1e0258d183fb37bd593d51ebe116bda
SHA512 9afd58913a67c1a7614d687d151da59e1cad643f47b46e39a946dbb4c0baffa12b3e81515be93dd3625341a520d930093908f5a3ec263029718768de8af27268
TLSH
T1EC51BFF7C3E8852DC91156F0BB186E2BCE1D0914832C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b4320edafd24982873e5d55d385dc8383ecaab4b0fe1a9eda141c6a6f34d99d0
MD5 98a9bd20bfb17b698e0913103d11608b
SHA1 6216e2b1f94f1f5c7bfdcf624864751a48f186aa
SHA512 516dd7b6bc55bc07bc0429796ea6c626e96fbb943173873f8a3d6b74a26c215ac3a2fe2c47403b701b7410cc7fb52d033c78a78757c2887dbd71559996a0230e
SSDEEP 192:sxR0RY/yM/jK1Ml8wcH/f2skTFt78eZ7zCKzoA8p9D/g6+WNCaB/YyxJ8G44k4E3:sxR0y5CH/f2sKFGYPCHN/5V/dQBF3
TLSH
T10462EA166A285D7B8CCBD209FA557F53D6F91562A2901E48A9FCCB0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e2915f4ed7ad9f7ecb1ea2931d6140abf452fb9ab56ed96bc554a1fbb9778d16
MD5 f2165b72837e569f4587861b5b1323be
SHA1 c5610d15c0dae66b3cd1212dd54dd24a681e1026
SHA512 39392540c5a5e530eac517f7bc7b4f7d5e6e281d4ecaf46880f770720419cf13fa5705a99ef951a6b9670325dfb7009b7040007665fe876ee6256349e12083f5
SSDEEP 192:sxRzRY/yM/jK1Ml8UQVcH/f2sQ2TFt7peZ7zCKzoA8prD/g6+WNCaB/YybJ8G44C:sxRzy5qaH/f2sQsFHYPCHf/5V/PQBFR
TLSH
T1D562DA16A6289D7B8CDBD209FA557F53D2F51572A2901E48AAFCCB0C01E77DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0009b54a6ae99bf93ddc217e92f3d008efc42d271af7e9649d3d1f3091ed5231
MD5 c461150c67481d3afd65c5dbe4d4926b
SHA1 1893995533e897bd659f895ad1055c7bae898965
SHA512 2fe9ce416dccd343a430e0276bd8e2b2ab9ba401618535196451413e42e8dc68b5e96c0b5cdd2348c9e36d452cf68a857e97bd2e4aef63c39f4f183a388f651d
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OViFfcciFro5JlZ/:AIox/OE7p0WguMfnAu1japFfXi+5JP
TLSH
T1B5E2EB3B680CCB7F4F8049DCEC29BE9A6DA801CF96D8CD9447FA841C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6f437eadb25240a34aa0b567f915d13ac1dbdd6314159236b75b8b75ac6af43e
MD5 708bc367a696a3033e6019c5f5ec5f01
SHA1 7a896a98911fef912dc5a334c889c687eda0e93f
SHA512 ed3bf122ba58ef6c8c67639f9f32f633945b18cff65ae4f3999877d85c216fbd1eba81a547b1d151f4d2b03cf61e286da938ed3937bad6f2f985fb0df3cf471f
SSDEEP 96:K0AgKluqi4AKV+WaYKHq2OxWKisfB+PrZ8:qbL6z5OB+PrZ8
TLSH
T191B1E490797F17803D3D650A82B9E42B518130A230DEA4AB7BA950E65F67F405FFC6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb1bbe32-b32e-4968-bc15-621fc3618ce1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb1bbe32-b32e-4968-bc15-621fc3618ce1.tmp
Size 14KB
SHA256 1e190eb3df56d1d0038fb944aef89906f6d0ffa17eb9e332f795a07722146d43
MD5 744a745108432fddf8bb431e4a9a9605
SHA1 a2fde46ceb8977bafce99525bd176fe926c38d01
SHA512 9bf14856cb814e579bf92e4ee03397b9854002c7f9dd12a1f2b2a6d609be6247b27bd1a2c317a20f13f3da78c49fb048c6ff81b639a3aa7eb4dfa132bfea8c5e
SSDEEP 192:sxRzRY/yM/jK1Ml8wcH/f2sQ2TFt78eZ7zCKzoA8p9D/g6+WNCaB/YyxJ8G44k4M:sxRzy5CH/f2sQsFGYPCHN/5V/dQBF3
TLSH
T10462EA16AA385D7B8CCBD209FA557F53D6F91572A2901E48A9FC8B0C01E77DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71e0c867-8e67-45ab-a5e3-d51fec6a0f96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\71e0c867-8e67-45ab-a5e3-d51fec6a0f96.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7840e0f277208010cf413f4679b7ed92089b25b94ea34b627721733c865cd8c3
MD5 22f15bfc67727d425486983d66072bbe
SHA1 ca5c8cfadff3b3ee88561dea6580af4168236898
SHA512 a1448c520155e9501a9cf207916e70ce77c9a6300f664bd0be13e97f1eebd5018404f8255425d8cb0e46bbc5fa28f5b7b8bb4c1f6d5e130a6f5f8ecb7befdf52
SSDEEP 768:Yj+9u3CN1lQOJI9QPSE/hUAFjQIMyOV3N5E9E8Dl8BvTPau:H9u3kdhNFUIpONNmBDl0Wu
TLSH
T1FEF2AE71B8A5DEA74CE7E3C9771632876FE4017754851A84DAEEAB0D014338D134BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ca14f2d4a4190c9c57708ec261e09cda35050f593ff34bcca130e94328cb9ce4
MD5 d471fccc1454d284fc8707a4655dd66d
SHA1 65cc8bd3255686e464a4b2ec7026b2cd203856c1
SHA512 1978d6c9b02ed5f880cc8e37f308ba76c41fc86af30a71c3e22e4afadc03d5b033432516aec5b1227371cd24ea2fe92d65a57d6f596222bda2a6af4bd43859e9
SSDEEP 768:9rv+4UNbdF35tbQOJI9QF/hUAFjQIMyOV3N5E9M85+8r0mL:9bsbf3fRhNFUIpONNmXDrv
TLSH
T10E03BF32E8A5DAB39CE7A7C5760A72437FF4416355C10784C9DE2B0D824B1DD231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2de0e99dfd4b10bf5959d0cb9791a2de9839d0a1d3f6b3995b47a9edc2125e1b
MD5 05143aeaea7c8ff9358e2b148c6204d0
SHA1 66b47cfed05c1777e70c50a2d0eb6edee4dba477
SHA512 d0abad59ce03c933760c1315494a5a08253016e5cb643c75af0b0b78e665bb9bdf58b44d7f8e4f28046b1d6b7664315be4bfa42508b9de4cb5003e0ed1b2d00b
SSDEEP 768:hj+9u3NN1lQOJI9QPSE/hUAFjQIMyOV3N5E9E8Dl8BvTPau:89u33dhNFUIpONNmBDl0Wu
TLSH
T144F2AE71B8A5DEA74CE7E3C9771632876FE8017758851A84DAEE6B0D024338D134BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 979fd121bd2061c39ea5cb2dcda0e72ad80c5279fed9311750fbb9d32d520483
MD5 ffbb68f68bb657f4f29334bbf3a75965
SHA1 499eb347197b0fef4cc840758e1d0a95d6355ab3
SHA512 c531abcacb23cbc01e678d097e907c9a68b37174c6596faaa9463d8eaa03362a34caa1045254f6f087be83010015a0f898597c1763d12d06c7b1738f289f7dad
SSDEEP 768:4F1j+9p3awgdNsQrOJI9QPSw/hUAFjQIMyOV3N5E9E8Dl8BvTPau:19p3pfhNFUIpONNmBDl0Wu
TLSH
T1F1134AF198D7CA76D8AE9787673D2E865ABCC16374841880B7D95E0CCC422BFC346C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c6df8999c318fa784bc73e866a9325ab4b562b4e0a775946e0ac069d1e69f8c5
MD5 66b145d49223687cf0a5d6deba7415d0
SHA1 bb2eb18564d12952e9507de11302ca48d57acbf9
SHA512 9615c51178948125c4ca79829418b239594504090e30829587a8294c203115739b1790906c82324f1c974ab534042cc181d44bc939dfc6d15f8c47d27c4e5b38
SSDEEP 768:Yrv+4UNbdY3ONIlQOJI9QPSC/hUAFjQIMyOV3N5E9E8t:Ybsb63nxhNFUIpONNmBt
TLSH
T1E803BF31B8A9DEA35CFBE385761A72833FB8116748C50A44D9EE6B0C42472CE174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

3b22ba68-565e-486c-aabf-cd0d5288c2c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3b22ba68-565e-486c-aabf-cd0d5288c2c4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4380_1620285718\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-241-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/576-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/576-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/984-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1712-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1916-281-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2392-375-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2432-298-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-289-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-409-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3820-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4092-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4092-350-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4388-485-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4436-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4436-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5076-193-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5388-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5496-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5496-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5592-388-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5592-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5592-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5592-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5592-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download